'''
Created on 2011-10-12

@author: latios
'''

import re, sys, csv

class COL:
    time = 0
    src = 1
    host = 2
    usr = 3
    action = 4
    target = 5
    misc = 6
    tamper = 7
    tag = 8   
    total = 8

rules = [
         #
         #msword
         #
         #NTFS doc* file
         ({COL.src:'NTFS', COL.action:'create', COL.target: r'.*\.(doc|docx)$'},
           'msword')
         ,
         #registry doc* file
         ({COL.src:'reg', COL.action:"word", COL.target:r'.*\.(doc|docx)$'},
          'msword')
         ,
         #registry open
         ({COL.src:'REG', COL.action:'OPEN', COL.target: r'.*\\winword\.exe'},
          'msword')
         ,
         #appdata WRS temp file
         ({COL.src:'NTFS', COL.action:'create', COL.target:r'.*\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content\.Word\\~WRS\{.*}\.tmp'''},
          'msword')
          ,
          #appdata WRF temp file
         ({COL.src:'NTFS', COL.action:'create',
           COL.target:r'.*\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content\.Word\\~WRF\{.*}\.tmp'''},
          'msword'
          )
          ,
          #prefetch file
          ({COL.src:'NTFS', COL.action:'modifyContent', COL.target:r'.*\\windows\\prefetch\\winword\.exe.*\.pf'},
           'msword')
          ,
          #Content.Word folder
          ({COL.src:'NTFS', COL.action:'.*subDirChange.*', COL.target:r'.*\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content\.Word'''},
          'msword')
          ,
          #appdata word folder and sub file
          ({COL.src:'NTFS', COL.action:'.*', COL.target:r'.*\\AppData\\Roaming\\Microsoft\\Word\\.*'},
           'msword')
          ,
         #pip file
         ({COL.src:'ntfs', COL.target:r'.*\\AppData\\Roaming\\Microsoft\\Office\\Word12\.pip'},
          'msword')
         ]

def __matchrule(rule, csvrow):
    for col, str in rule.items():
        match = re.match('(?i)' + str, csvrow[col])
        if (match is None):
            return False
    return True

def calculatetag(csvrow):
    ret = ''
    for rule, tag in rules:
        if (__matchrule(rule, csvrow)):
            ret += tag + '|'
    return ret
          
          
if(__name__ == '__main__'):
    reader = csv.reader(sys.stdin)
    for row in reader:
        tag = calculatetag(row)
        if (row[COL.tag] == tag):
            print('pass')
        else :
            print(row, tag)
    
